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Description 

[0001] The present invention relates generally to a 
method for removing funds from a postage meter and, 
more particularly, to such method for removing funds 
from a postal security device coupled to a personal com- 
puter. 

[0002] The Information-Based Indicia Program 
("IBIP") is a distributed trusted system proposed by the 
United States Postal Service ("USPS") to retrofit and 
augment existing postage meters using newtechnology 
known as information-based indicia. The program relies 
on digital signature techniques to produce for each en- 
velope an indicium whose origin cannot be repudiated 
and content cannot be modified. IBIP is expected to sup- 
port new methods of applying postage in addition to the 
current approach, which typically relies on a postage 
meter to mechanically print indicia on mailpieces. IBIP 
requires printing a large, high density, two-dimensional 
("2-D") bar code on a mailpiece. The 2-D bar code en- 
codes information and is signed with a digital signature. 
[0003] The USPS has published draft specifications 
for IBIP. The INFORMATION BASED INDICIA PRO- 
GRAM (IBIP) INDICIUM SPECIFICATION, dated June 
13, 1996, and revised July 23, 1997, ("IBIP Indicium 
Specification") defines the proposed requirements for a 
new indicium that will be applied to mail being processed 
using IBIP. The INFORMATION BASED INDICIA PRO- 
GRAM POSTAL SECURITY DEVICE SPECIFICATION, 
dated June 13, 1996, and revised July 23, 1997, ("IBIP 
PSD Specification") defines the proposed requirements 
for a Postal Security Device ("PSD") that will provide se- 
curity services to support the creation of a new "infor- 
mation based" postage postmark or indicium that will be 
applied to mail being processed using IBI P. The INFOR- 
MATION BASED INDICIA PROGRAM HOST SYSTEM 
SPECIFICATION, dated October 9, 1996, defines the 
proposed requirements for a host system element of 
IBIP ("IBIP Host Specification"). The specifications are 
collectively referred to herein as the "IBIP Specifica- 
tions". IBIP includes interfacing user (user), postal and 
vendor infrastructures which are the system elements 
of the program. The INFORMATION BASED INDICIA 
PROGRAM KEY MANAGEMENT PLAN SPECIFICA- 
TION, dated April 25, 1997, defines the generation, dis- 
tribution, use and replacement of the cryptographic keys 
used by the USPS product/service provider and PSDs 
("IBIP KMS Specification"). 

[0004] The user infrastructure, which resides at the 
user's site, comprises a PSD coupled to a host system 
("Host") with printer. The PSD is a secure processor- 
based accounting device that dispenses and accounts 
for postal value stored therein. 
[0005] The IBIP Indicium Specification provides re- 
quirements for the indicium that consists of both human- 
readable data and PDF41 7 barcode data. The human- 
readable information includes an originating address, 
including the 5-digit ZIP Code of the licensing post of- 



fice, PSD ID/Type number, date of mailing and amount 
of the applied postage. The bar code region of the ind- 
icium elements includes postage amount, PSD ID, user 
ID, date of mailing, originating address, destination de- 

5 livery point identification, ascending and descending 
registers and a digital signature. 
[0006] An integrated mailing system is subject to open 
system requirements if it includes a computer interfaced 
to the meter and it prepares mailpiece fronts or labels 

10 that include both the destination address and the indici- 
um. The integrated system is an open system even if 
different printers apply the address and the indicium. If 
the mailing system satisfies such criteria, the USPS con- 
siders the "meter" to be an open system peripheral de- 

15 vice that performs the dual functions of printing the in- 
dicia and interfacing the PSD to the Host. The integrated 
mailing system must be approved by the USPS accord- 
ing to open system criteria. 

[0007] The IBIP Host Specification sets forth the re- 
20 quirements for a Host in an open system. The Host pro- 
duces the mailpiece front including the return address 
(optional), the delivery address (required), the Facing 
Identification Mark ("FIM"), and the indicium as an inte- 
gral unit. The Host may print this unit on the actual mail- 
25 piece stock or label(s) for later attachment to the mail- 
piece. The Host provides the user with an option to omit 
the FIM (e.g., when the FIM is preprinted on envelopes). 
The Host produces standardized addresses, including 
standard POSTNET delivery point bar code, for use on 
30 the mailpiece. The Host verifies each address at the 
time of mailpiece creation. The Host then creates the 
indicium and transmits it to the printer. 
[0008] The IBIP Specifications define a stand-alone 
open metering system, referred to herein as a PC Meter 
35 or Stand-alone PC Meter. The Stand-alone PC meter 
has one personal computer ("PC") which operates as 
the Host ("Host PC"). The Host PC runs the metering 
application software and associated libraries (collective- 
ly referred to herein as "Host Applications" and "PC Me- 
40 ter Toolkit") and communicates with one or more at- 
tached PSDs. The Stand-alone PC Meter can only ac- 
cess PSDs coupled to the Host PC. There is no remote 
PSD access for the Stand-alone PC Meter. 
[0009] The Stand-alone PC Meter processes transac- 
ts tions for dispensing postage, registration, and refill on 
the Host PC. Processing is performed locally between 
the Host and the PSD coupled thereto. Connections to 
a Data Center, for example for registration and refill 
transactions, are made locally from the Host through a 
so local or network modem/internet connection. Account- 
ing for debits and credits to the PSD are also performed 
locally, logging the transactions on the Host PC, which 
is the PC where the transactions are processed on and 
to which the PSD is attached. Thus, the accounting of 
55 funds and transaction processing are centralized on a 
single PC. The Host PC may accommodate more than 
one PSD, for example supporting one PSD per serial 
port. Several application programs running on the Host 
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PC, such as a word processor or an envelope designer, 
may access the Host metering software. 
[0010] It is expected that once IBIP is launched, the 
volume of meters will increase significantly when the 
PC-based meters are introduced. Such volume in- 
crease is expected in the small office and home office 
(SOHO) market. The IBIP Specifications address and 
resolve issues which minimize if not eliminate USPS 
risks regarding security and fraud. However, as with any 
system implemented on a non-secure device, such as 
a personal computer, implementation of an IBIP system 
may have inherent security weaknesses that could be 
exploited by sophisticated users intent on defrauding 
the USPS, 

[0011] The IBIP Specifications do not specify any 
method for the removal of funds from the PSD, such as, 
safely sending funds to the Data Center when a PSD is 
taken out of service. Contrarily, the IBIP Host and PSD 
Specifications do not permit the zeroing of registers, 
which is common practice in current Pitney Bowes me- 
ters (except for the Personal Post Office™ digital meter 
as described below). It is anticipated that the removal of 
funds from a PSD would be accomplished using con- 
ventional methods. 

[0012] Historically, mechanical postage meters that 
are being taken out of service have to be physically re- 
turned to the Post Office, opened and registers zeroed. 
This method has drawbacks, the most significant of 
which is the possibility of theft of an active meter and 
also the inconvenience of making the return. 
[001 3] Today, when a conventional electronic postage 
meter is taken out of service, a vendor service repre- 
sentative retrieves the postage meter from a customer, 
and contacts the Data Center's voice response unit or 
VRU. The service representative enters a special re- 
quest code for zeroing the meter's registers and sends 
the request to the Data Center. The Data Center gener- 
ates a combination code, for example, a 4 digit code as 
opposed to the standard 6 digit code. The service rep- 
resentative enters the combination code into the post- 
age meter with an amount of ".00" to indicate to the post- 
age meter that a special register clear operation is to be 
performed. The postage meter then resets the registers 
of the meter to 0. 

[001 4] This is not a very secure method, since it relies 
on the customer service representative to be accurate 
in reading the registers and putting that information cor- 
rectly into a computer or on a piece of paper for manual 
processing. The postage meter, however, serves as a 
backup to this process by holding a history of past reg- 
isters in memory. The manual nature of this process can 
lead to potentially improper or disputed refund amounts. 
[0015] In the Personal Post Office digital meter, an im- 
provement was made to the existing process. A custom- 
er who no longer desires the product or is getting a new 
meter places a call to the Data Center. The Data Center, 
knowing that the meter is in a pending withdrawal status, 
sends a command to the meter requesting that a debit 



be made to the meter for an amount equal to that of the 
current descending register. The meter, upon receipt of 
the command, debits for the appropriate amount and 
generates a digital signature, also referred to herein as 

5 a token, for the mailpiece that would have been printed 
if the deduction was to occur on a mailpiece. The digital 
token and other information that would have been print- 
ed on the mailpiece are sent to the Data Center for ver- 
ification to ensure that the meter properly deducted the 

10 appropriate funds. However, it should be noted that the 
digital token is generated in exactly the same way as for 
a valid mailpiece. Therefore, by intercepting, for exam- 
ple by listening, to the communications with the Data 
Center, it would be possible for an attacker to obtain val- 

*5 id digital tokens. These tokens and associated postal 
information could be imprinted on a mailpiece, thus giv- 
ing the attacker free postage. The amount of free post- 
age could be significant, e.g., for priority mail mailpiece. 
The attacker could also print an indicium and bring the 

20 indicium to the Post Office for a refund. 

[0016] It has been found that the present invention 
eliminates a window of opportunity for an attacker to in- 
tercept and use information valid for postage evidenc- 
ing. The present invention provides a better security 

25 method to upload postage to the Data Center in open 
system meters. When a PSD is taken out of service, a 
call is placed to the Data Center. After the client estab- 
lishes contact with the Data Center, the Data Center 
sends a command to the client to extract the funds in 

30 the PSD. The client requests a debit from the PSD equal 
to the amount of the current descending register value, 
and supplies the PSD with an invalid destination zip 
code (such as "0000000000") or other invalid input data, 
which cannot be used to print valid mailpieces. The PSD 

35 debits the descending register, credits the ascending 
register and generates a digital signature using the 
invalid destination zip code. The digital signature is sent 
to the Data Center for verification that the funds have 
been truly extracted from the PSD. 
[0017] The method of the present invention for the 
open system PSD would be similar to that previously 
described for the Personal Post Office digital meter (Da- 
ta Center commanding client to debit for amount of DR, 
with resulting postal data sent to Data Center for verifi- 
es cation), with the exception that the client software run- 
ning on the PC would supply an invalid mailing zip such 
as "00000000000" or "99999999999" in the PSD's debit 
command. This improvement in accordance with the 
present invention prevents the generated PSD digital 

50 signature from being used on a mailpiece, because the 
destination zip code used to produce the digital signa- 
ture would not match any valid destination address. A 
mailpiece with an invalid destination zip code would be 
detected during mailpiece verification by the Post Office. 

55 This could be further strengthened because the PSD 
could actually receive non-numeric data (i.e.; ASCII 
character codes) for this process. 
[001 8] Other alternatives such as placing the destine- 
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tion zip code of the Pitney Bowes Data Center, 
"06926070001", are possible. This, however, is a valid 
mailing zip, and therefore a user could use the informa- 
tion to send mail to Pitney Bowes in similar fashion to 
the Personal Post Office digital meter method described 
above. 

[0019] Currently, the choice of invalid destination zip 
code is left up to the client. Alternatively, the Data Center 
can supply the invalid destination zip code or other 
invalid data to use for the funds withdrawal rather than 
the client hardcoding the answer. This would allow for 
the Data Center to change between one or more invalid 
zip codes for added security. 

[0020] The present invention provides a method for 
removing postal funds from a postage meter. The meth- 
od includes providing an accounting unit of a postage 
meter with indicium-related information which is invalid 
for mailing. The accounting unit generates a digital sig- 
nature, which is an encrypted value of the postal funds 
removed from the postage meter and other postal data 
including the indicium-related information. The account- 
ing unit through a Host PC sends to a data center the 
amount of the postal funds removed from the postage 
meter and the digital signature. The data center verifies 
that the digital signature has been generated using the 
indicium-related information. The meter is disabled 
when the digital signature cannot be verified. When the 
digital signature is verified a request for a refund is sent 
by the data center to a postal authority. An example of 
the indicium-related information is an invalid destination 
postal code or an invalid origination postal code. 
[0021 ] The above and other objects and advantages 
of the present invention will be apparent upon consider- 
ation of the following detailed description, taken in con- 
junction with accompanying drawings, in which like ref- 
erence characters refer to like parts throughout, and in 
which: 

Fig. 1 is a block diagram of a prior art open metering 
system; and 

Fig. 2 is a flow chart of the process for removing 
funds from a PSD in accordance with an embodi- 
ment of the present invention. 

[0022] In describing the present invention, reference 
is made to the drawings, wherein there is seen in Fig. 1 
a block diagram of an IBIP open metering system, also 
referred to herein as a PC meter system, generally re- 
ferred to as 10. The PC meter system includes a con- 
ventional personal computer (PC) 12, including display 
and keyboard (not shown) configured according to the 
IBIP Specifications to operate as a Host PC to a periph- 
eral metering device, i.e., the PSD, generally referred to 
as 20, in which postage funds are stored. Coupled to 
Host PC 12 is a conventional printer 24, which is pref- 
erably a laser or ink-jet printer. The IBIP open metering 
system 10 uses Host PC 12 and Its printer 24 to print 
postage on envelopes at the same time it prints a recip- 



ient's address or to print labels for pre-addressed return 
envelopes or large mailpieces. It will be understood that 
although the preferred embodiment of the present in- 
vention is described as a postage metering system, the 
5 present invention is applicable to any value metering 
system that includes transaction evidencing using an 
unsecured printer. 

[0023] Host PC 1 2 includes a conventional processor, 
such as the Pentium processors manufactured by Intel, 
10 and conventional hard drive, floppy drive(s), and mem- 
ory. PSD 20 is a microprocessor-based secure encryp- 
tion device for postage funds management, signature of 
postal data and traditional accounting functions. Host 
PC 1 2 also includes a modem 28 by which the Host PC 
15 communicates with a Postal Service or a Data Center 
5, typically managed by a postal authenticating vendor, 
for recharging funds (debit or credit) . In an alternate em- 
bodiment (not shown) the modem may be located in 
PSD 20. In yet another alternate embodiment, commu- 
nication with Data Center 5 may be through the internet. 
[0024] In addition to running application programs 32, 
Host PC 12 processes the functions for PSD registra- 
tion, PSD refill, and postage dispensing transactions for 
PSD 20. Processing is performed locally by metering 
software 30 (referred to herein as "PC Meter Toolkit") 
running in Host PC 12. In the preferred embodiment, the 
PC Meter Toolkit 30 is a Component Object Model/Dis- 
tributed Component object Model (COM/DCOM) object 
(typically implemented as a dynamic link library (DLL) 
or OLE control) with interfaces to perform metering op- 
erations. An example of a PC metering system using a 
DLL with interfaces to perform metering operations is 
described in European Patent Application No. EP-A- 
0780809, filed December 19, 1996. 
[0025] Referring now to Fig. 2, there is seen a method 
for removing funds from PSD 20. At step 100, the PSD 
initiates a funds debit by contacting the Data Center. At 
step 105, the Data Center responds with an audit re- 
quest. At step 110, the meter performs an audit of its 
registers and sends the results of the audit to the Data 
Center. At step 115, the Data Center verifies the results 
of the audit. If the results are verified, then, at step 1 20, 
the Data Center requests from the meter an indicium 
including a digital signature using an invalid postal code 
and the amount of the descending register of the PSD. 
In the preferred embodiment, while an invalid postal 
code is sent to the PSD, it should be noted that any data 
which would produce an indicium that is invalid for mail- 
ing could be used. For example, any data used in the 
generation of the digital signature or token, such as 
invalid origin zip or date, could be used. If the results 
are not verified, then, at step 1 45, the Data Center sends 
a disable message to the PSD, and at step 1 50, the me- 
ter is disabled. 

[0026] At step 125, in response to the Data Center's 
request for an indicium, the meter generates an indicium 
and sends it to the Data Center. It is noted that the meter 
does not generate an indicium image in response to the 
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Data Center's request, but does generate and send to 
the Data Center data that would be included in the ind- 
icium image. The steps of generating an indicium in- 
clude debiting the descending register and crediting the 
ascending register for the amount of the funds removed 
from the PSD. At step 130, the Data Center determines 
if the received indicium can be verified. If the indicium 
can be verified, then, at step 1 35, the Data Center sends 
a request to the postal authority for a refund to the cus- 
tomer's account for an amount equal to the descending 
register as provided in the indicium. At step 140, The 
Data Center determines whether the PSD should be dis- 
abled, for example, if the descending register has been 
cleared. If the PSD should be disabled from step 140, 
or if the indicium cannot be verified at step 130, then, at 
step 145, the Data Center sends a disable message to 
the PSD, and, at step 150, the meter is disabled. If, at 
step 1 40, the meter should not be disabled, for example, 
if the descending registered has not been cleared as in 
the case of a partial refund, then the meter continues 
normal processing. 

[0027] The present invention has been described for 
an open system meter, such as defined by the IBIP 
Specifications. It will be understood that the present in- 
vention is also suitable for closed system digital meters, 
such as the previously noted Personal Post Office digital 
meter, using invalid or Data Center-supplied origin post- 
al or date of mailing information. 
[0028] It will be understood that although the embod- 
iment of the present invention is described for a postage 
metering system, the present invention is applicable to 
any value metering system that includes transaction ev- 
idencing, such as monetary transactions, item transac- 
tions and information transactions. Such value metering 
systems, for example a tax meter, would use invalid or 
Data Center-supplied information, such as an invalid 
date. 

[0029] While the present invention has been dis- 
closed and described with reference to the embodi- 
ments hereof, it will be apparent, as noted above, that 
variations and modifications may be made therein. It is, 
thus, intended in the following claims to cover each var- 
iation and modification that falls within the scope of the 
present invention. 



Claims 

1 . A method for removing postal funds from a postage 
meter, the method comprising the steps of: 

providing the accounting unit (20) of a postage 
meter (10) with indicium-related information 
which is invalid for mailing; 
generating (125) a digital signature, said digital 
signature being an encrypted value of the post- 
al funds removed from the postage meter (10) 
and other postal data including said indicium- 



related information; 

sending (125) to a data center (5) the amount 
of the postal funds removed from the postage 
meter (10) and the digital signature; and 
5 verifying (130) at the data center (5) that the 

digital signature has been generated using the 
indicium-related information. 

2. The method of Claim 1 comprising the further steps 
10 of: 

disabling (150) the meter (1 0) when the digital 
signature cannot be verified; and 
sending (135) a request for a refund to a postal 
is authority when the digital signature is verified. 

3. The method of Claim 1 or 2, wherein the indicium- 
related information is an invalid destination postal 
code. 

20 

4. The method of Claim 1 or 2, wherein the indicium- 
related information is an invalid origination postal 
code. 

25 5. The method of Claim 1 wherein the data center (5) 
provides the indicium-related information to the 
postage meter (10). 

6. A method for removing funds from a transaction ev- 
30 idencing device, the method comprising the steps 

of: 

providing the accounting unit (20) of a transac- 
tion evidencing device (10) with transaction-re- 

35 lated information which is invalid; 

generating (125) a digital signature, said digital 
signature being an encrypted value of the funds 
removed from the transaction evidencing de- 
vice (10) and other data including said transac- 

40 tion-related information; 

sending (125) to a data center (5) the amount 
of the funds removed from the transaction evi- 
dencing device (10) and the digital signature; 
and 

45 verifying (130) at the data center (5) that the 

digital signature has been generated using the 
transaction-related information. 

7. The method of Claim 6 comprising the further steps 
50 of: 

disabling (150) the transaction evidencing de- 
vice (10) when the digital signature cannot be 
verified; and 

55 sending (1 35) a request for a refund to a trans- 

action authority when the digital signature is 
verified. 
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8. The method of Claim 6 or 7, wherein the transac- 
tion-related information is an invalid date. 

9. The method of Claim 6, 7 or 8, wherein the trans- 
action evidencing device (10) is a tax meter. 

1 0. The method of Claim 6 wherein the data center (5) 
provides the transaction-related information to the 
transaction evidencing device (10). 



Patentansprtiche 

1 . Verfahren zum Entfemen von postalischen Geldern 
aus einer Frankiermaschine, wobei das Verfahren 
die folgenden Schritte aufweist: 

Versehen der Abrechnungseinheit (20) einer 
Frankiermaschine (10) mit freimachungsver- 
merkbezogener Information, diefureinen Post- 
versand ungultig ist; 

Erzeugen (125) einer digitalen Signatur, wobei 
die digitale Signatur ein verschliisselter Wert 
der von der Frankiermaschine (10) entfernten 
postalischen Gelder und anderer postalischer 
Daten einschlieBlich der freimachungsver- 
merkbezogenen information ist; 

Senden (125) des Betrags der von der Fran- 
kiermaschine (10) entfernten postalischen Gel- 
der und der digitalen Signatur zu einem Daten- 
zentrum (5); und 

bei dem Datenzentrum (5) unter Verwendung 
der freimachungsvermerkbezogenen informa- 
tion Verifizieren (130), dass die digitale Signa- 
tur erzeugt worden ist. 

2. Verfahren nach Anspruch 1 , das weiterhin die fol- 
genden Schritte aufweist: 

Sperren (150) der Frankiermaschine (10), 
wenn die digitale Signatur nicht verifiziert wer- 
den kann; und 

Senden (135) einer Aufforderung fur eine 
Ruckzahlung zu einer Postbehdrde, wenn die 
digitale Signatur verifiziert wird. 

3. Verfahren nach Anspruch 1 oder 2, wobei die frei- 
machungsvermerkbezogene Information eine un- 
gultige Zielort-Postleltzahl ist. 

4. Verfahren nach Anspruch 1 oder 2, wobei die frei- 
machungsvermerkbezogene Information eine un- 
gultige Ursprungs-Postleitzahl ist. 



5. Verfahren nach Anspruch 1 , wobei das Datenzen- 
trum (5) die freimachungsvermerkbezogene Infor- 
mation der Frankiermaschine (10) zur Verfugung 
stellt. 

5 

6. Verfahren zum Entfernen von Geldem von einer 
Transaktionsnachweisvorrichtung, wobei das Ver- 
fahren die folgenden Schritte aufweist: 

10 Versehen der Abrechnungseinheit (20) einer 

Transaktionsnachweisvorrichtung (10) mit 
transaktionsbezogener Information, die ungul- 
tig ist; 

15 Erzeugen (125) einer digitalen Signatur, wobei 

die digitale Signatur ein verschliisselter Wert 
der Gelder ist, die von der Transaktionsnach- 
weisvorrichtung (10) entferntsind, und anderer 
Daten einschlieBlich der transaktionsbezoge- 

20 nen Information, 

Senden (125) des Betrags der Gelder, die von 
derTransaktionsnachweisvorrichtung (10) ent- 
fernt sind, und der digitalen Signatur zu einem 
25 Datenzentrum (5); und 

bei dem Datenzentrum (5) unter Verwendung 
der transaktionsbezogenen Information Verifi- 
zieren (130), dass die digitale Signatur erzeugt 
30 worden ist. 

7. Verfahren nach Anspruch 6, das die weiteren fol- 
genden Schritte aufweist: 

35 Sperren (150) der Transaktionsnachweisvor- 

richtung (10), wenn die digitale Signatur nicht 
verifiziert werden kann; und 

Senden (135) einer Aufforderung fur eine 
to Ruckzahlung zu einer Transaktionsautoritat 

bzw. Transaktionsbehorde, wenn die digitale 
Signatur verifiziert wird. 

8. Verfahren nach Anspruch 6 oder 7, wobei die trans- 
45 aktionsbezogene I nf ormation ein u ngultiges Datum 

ist. 

9. Verfahren nach Anspruch 6, 7 oder 8, wobei die 
Transaktionsnachweisvorrichtung (10) ein Gebiih- 

50 renmessgerat ist. 

10. Verfahren nach Anspruch 6, wobei das Datenzen- 
trum (5) die transaktionsbezogene Information der 
Transaktionsnachweisvorrichtung (10) zur Verfu- 

55 gung stellt. 
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Revendications 

1. Procede pour la suppression de fonds postaux 
d'une machine a affranchir, le procede comprenant 
les etapes suivantes : 

approvisionnement de la division comptable 
(20) d'une machine a affranchir (10) en infor- 
mations relatives a un indice d'affranchisse- 
ment non valides pour I'expedition ; 
generation (125) d'une signature numerique, 
ladite signature numerique etant une valeur 
cryptee des fonds postaux supprimes de la ma- 
chine a affranchir (1 0) et d'autres donnees pos- 
tales incluant lesdites informations relatives 
I'indice d'aff ranch issement ; 
envoi (125) a un centre de donnees (5) de la 
quantite des fonds postaux supprimes de la 
machine a affranchir (10) et la signature 
numerique ; et 

verification (1 30) au centre de donnees (5) que 
la signature numerique a ete generee a I'aide 
des informations relatives a I'indice d'affran- 
chissement. 

2. Procede selon la revendication 1 comprenant les 
etapes suivantes : 

deactivation (150) de la machine a affranchir 
(10), lorsque la signature numerique ne peut 
etre verifiee ; et 

envoi (1 35) d'une demande de remboursement 
a une autorite postale, lorsque la signature nu- 
merique est verifiee. 

3. Procede selon la revendication 1 ou 2, dans lequel 
I'information relative a I'indice d'affranchissement 
est un code postal de destination invalide. 

4. Procede selon la revendication 1 ou 2, dans lequel 
I'information relative a I'indice d'affranchissement 
est un code postal d'expedition invalide. 

5. Procede selon la revendication 1, dans lequel le 
centre de donnees (5) fournit les informations rela- 
tives a I'indice d'affranchissement a la machine a 
affranchir (10). 

6. Procede de suppression de fonds d'un dispositif de 
justification de transaction, le procede comprenant 
ies etapes suivantes: 

approvisionnement de la division comptable 
(20) d'un dispositif de justification de transac- 
tion (10) en informations relatives a la transac- 
tion qui sont invalides ; 

generation (125) d'une signature numerique, 
ladite signature numerique etant une valeur 



cryptee des fonds supprimes du dispositif de 
justification de transaction (1 0) et d'autres don- 
nees incluant lesdites informations relatives a 
la transaction ; 

5 envoi (125) a un centre de donnees (5) de la 

quantite des fonds supprimes du dispositif de 
justification de transaction (10) et la signature 
numerique ; et 

verification (130) au centre de donnees (5) que 
10 la signature numerique a ete generee a I'aide 

des informations relatives a la transaction. 

7. Procede selon la revendication 6 comprenant les 
autres etapes suivantes : 

15 

deactivation (150) du dispositif de justification 
de transaction (10), lorsque lasignature nume- 
rique ne peut etre verifiee ; et 
envoi (135) d'une demande de remboursement 
20 a une autorite de transaction, lorsque la signa- 

ture numerique est verifiee. 

8. Procede selon la revendication 6 ou 7, dans lequel 
I'information relative a la transaction est une date 

25 invalide. 

9. Procede selon la revendication 6, 7 ou 8, dans le- 
quel le dispositif de justification de transaction (1 0) 
est un compteurteletaxe. 

30 

10. Procede selon la revendication 6, dans lequel le 
centre de donnees (5) fournit les informations rela- 
tives a la transaction au dispositif de justification de 
transaction (10). 
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